CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.

  • Published Sep 23, 2026
  • CVSS 8.2 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-96599 at the National Vulnerability Database